Protects /config, selective labdata, and nightly DB dumps; documents homelab improvement plan briefs.